99bet9 Privacy Policy – Protected Data

99bet9 is a Sports Betting and online casino platform built for the Brazilian market. We understand that entrusting your personal data to a platform is a serious decision — which is why we have taken privacy seriously since day one.

This Privacy Policy was written to be read and understood by anyone, with no legal background required. We prefer plain language over technical jargon that makes things harder to follow. If anything is unclear, our team is available 24 hours a day to answer any questions via live chat or email.

99bet9 processes personal data exclusively for the purposes described in this document and on the legal grounds set out in the General Personal Data Protection Law (LGPD — Law No. 13,709/2018). We do not collect more data than is necessary to provide our services, and we do not retain information for longer than required by law or legitimate operational need.

The controller responsible for processing the personal data collected by the 99bet9 platform is the company operating the platform, as identified in the terms of use and service agreements available on the site. For the purposes of this policy, 99bet9 is the entity that determines the purposes and means of processing players' personal data.

99bet9's Data Protection Officer (DPO) can be reached by email at contato@99bet9.net. All privacy-related requests, exercise of data subject rights, and questions about this document must be sent to that address, with the requester's identification and a clear description of the request.

99bet9 collects personal data at various points during your interaction with the platform. We only collect what is necessary for the purposes described in this policy.

Data provided directly by you:

• At registration: full name, CPF, date of birth, residential address, email address, and mobile number;
• During identity verification (KYC): a photo ID (RG, CNH, or passport) and proof of address;
• For payments: Pix key, credit or debit card details (processed by PCI DSS-certified partners), and bank slip information;
• In support: the content of chat conversations and emails exchanged with our team.

Data collected automatically during use:

• Technical data: IP address, device type, operating system, browser, screen resolution;
• Behavioral data: pages visited, session duration, games and markets accessed, bets placed on the Brasileirão, Copa do Brasil, Libertadores, slots, live casino, and other categories;
• Cookies and similar technologies: session identifiers, language preferences, authentication status.

We do not collect sensitive data as defined by the LGPD (such as health data, biometrics, ethnic origin, or religious beliefs) except in exceptional situations with the data subject's express consent.

Every piece of data collected by 99bet9 has a specific purpose. Below are all the purposes for which we process personal data:

• Service delivery: process registrations, maintain active accounts, record Brasileirão and other sports bets, calculate results, and pay winnings via Pix or other methods;
• Identity verification: meet KYC obligations for anti-money laundering purposes and to prevent minors from accessing the platform;
• Payment processing: process deposits and withdrawals via Pix, boleto bancário, credit/debit card, PicPay, and Mercado Pago;
• Fraud prevention: identify and block suspicious activity, duplicate accounts, and bonus abuse;
• Player support: answer questions, resolve issues, and provide 24/7 support in Portuguese;
• Platform improvement: analyze usage patterns to improve the Sports Betting and casino experience;
• Marketing communications: send promotions, VIP Program updates, and relevant information — only with the player's express consent;
• Responsible gambling: monitor gameplay patterns to identify at-risk behavior and provide responsible gaming tools;
• Compliance with legal obligations: respond to requests from regulatory, tax, and judicial authorities as required by Brazilian law.

The LGPD requires that all personal data processing have a defined legal basis. 99bet9 processes your data under the following legal grounds:

• Contract performance: processing required to fulfill the service agreement accepted when creating your account — registration, betting, payments, withdrawals;
• Compliance with legal obligation: KYC identity verification, anti-money laundering compliance, and financial record retention as required by Brazilian law;
• Legitimate interest: fraud prevention, platform improvement, account security, and essential operational communications — always ensuring the data subject's interests are protected;
• Consent: marketing communications, non-essential cookies, and processing that goes beyond basic operational needs. Consent may be withdrawn at any time without affecting your access to the services.

99bet9 does not sell or trade players' personal data. Sharing occurs only in the situations described below and always with appropriate safeguards in place:

• Payment processors: data required to process deposits and withdrawals via Pix, boleto, credit/debit card, PicPay, and Mercado Pago is shared with the respective service providers, who are bound by data processing agreements and security certifications;
• Live casino and slots providers: minimum information required for authentication on Evolution Gaming, Pragmatic Play, PG Soft, and other integrated providers — session identifiers only, no full registration data;
• Identity verification services: documents submitted for KYC are processed by specialized identity verification partners bound by contractual confidentiality obligations;
• Public authorities: data may be shared with regulatory, tax, or judicial authorities when required by law, court order, or a legitimate request from a competent Brazilian authority;
• Fraud prevention: minimal data may be shared with industry anti-fraud networks to identify and block illicit activity.

All third parties that receive player data from 99bet9 are contractually required to use it solely for authorized purposes and to implement appropriate security measures.

99bet9 retains personal data only for as long as strictly necessary to fulfill the purposes for which it was collected, in compliance with the minimum retention periods required by applicable Brazilian law.

• Registration and identity data: retained for as long as the account is active, plus 5 years after closure — a period required by anti-money laundering obligations;
• Financial records (deposits, withdrawals, bets): retained for 5 years from each transaction, in accordance with tax and regulatory obligations;
• Access logs and technical data: retained for up to 6 months, or longer when required for ongoing security investigations;
• Marketing consent data: retained for as long as consent is active, plus 5 years after withdrawal as a record of historical consent;
• Self-exclusion records: retained indefinitely to prevent deleted accounts from being inadvertently reactivated.

Once retention periods expire, data is securely deleted or anonymized so that the original data subject can no longer be identified.

99bet9 implements technical and organizational measures to protect players' personal data against unauthorized access, alteration, disclosure, or accidental destruction. Measures in place include:

• 256-bit SSL encryption on all connections between the player's device and 99bet9 servers;
• Passwords stored using cryptographic hashing — no 99bet9 employee has access to a player's original password;
• Role-based access control: only staff with a legitimate need are permitted to access players' personal data;
• Two-factor authentication available for player accounts that require an additional layer of security;
• Continuous monitoring of suspicious activity on servers and account access patterns;
• Regular security testing and vulnerability audits conducted by specialized teams;
• Incident response plan — in the event of a data breach that may pose a risk to data subjects, 99bet9 will notify the ANPD and affected players within the legally required timeframes.

99bet9 uses cookies and similar tracking technologies to ensure the platform works correctly, improve the player experience, and — with consent — personalize marketing communications.

Types of cookies used:

• Essential cookies: required for the platform's basic operation — authentication, session management, language preferences, and security. These cannot be disabled without affecting your use of the platform;
• Analytical cookies: collect aggregated information about how players use the platform (most visited pages, session duration, errors encountered) to help 99bet9 continuously improve the experience;
• Preference cookies: store personalized settings such as your favorite sport, preferred layout, and notification preferences;
• Marketing cookies: used with consent to personalize communications about Brasileirão promotions, VIP Program bonuses, and platform updates.

You can manage your cookie preferences at any time through your account settings panel. Disabling non-essential cookies does not affect your access to the platform's core features.

The LGPD grants you, as the data subject whose information is processed by 99bet9, a set of rights that may be exercised at any time. 99bet9 is committed to responding to all requests within 15 business days.

You have the right to:

• Access: request a copy of all personal data that 99bet9 holds about you, including your registration details, betting history for the Brasileirão and other competitions, financial records, and access logs;
• Correction: request the correction of inaccurate or outdated data. Basic account details can be updated directly in the account dashboard;
• Deletion: request the deletion of data processed on the basis of consent. Data retained due to a legal obligation (such as financial records and KYC) cannot be deleted before the applicable regulatory retention period expires;
• Portability: receive your data in a structured, machine-readable format for migration to another service;
• Objection: object to data processing in specific situations provided for under the LGPD, particularly processing based on legitimate interest;
• Information: request information about which entities 99bet9 has shared your data with and for what purposes;
• Withdrawal: withdraw consent for processing based on that legal basis, without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, send an email to contato@99bet9.net with the subject line "LGPD Rights Request", identifying yourself with the full name and CPF registered on the platform, and clearly describing the right you wish to exercise. 99bet9 may request identity verification before processing requests involving access to or deletion of data.

99bet9 may update this Privacy Policy periodically to reflect changes in the services offered, applicable legislation, or data processing practices. The date of the most recent update is always shown at the top of this document.

Material changes that affect data subjects' rights will be communicated by email to registered players at least 10 days in advance. Continued use of the platform after the notice period constitutes acceptance of the new terms.

If you disagree with the changes, you may close your account and request the return of your available balance before the new rules take effect. Closing your account due to disagreement with privacy policy changes does not result in any penalty to the player.

Contact channels for privacy matters:

• DPO Email: contato@99bet9.net — for formal LGPD rights requests;
• 24/7 live chat — for general questions about privacy and data protection;
• If you believe your rights have not been adequately addressed, you may also file a complaint with the National Data Protection Authority (ANPD).